United States Patent (10) Patent No.: US 7.460,350 B2: Talbot Et Al. (45) Date of Patent: Dec. 2, 2008

USOO746035OB2
(12) United States Patent (10) Patent No.: US 7.460,350 B2

Talbot et al. (45) Date of Patent: *Dec. 2, 2008
(54) SELECTIVE POTTING FOR CONTROLLED (56) References Cited

FAILURE AND ELECTRONIC DEVICES
EMPLOYING THE SAME U.S. PATENT DOCUMENTS
3,558,987 A 1/1971 Lewis
(75) Inventors: Cary D. Talbot, Santa Clarita, CA (US); 4,101,816 A 7/1978 Shepter
Sheldon B. Moberg, Granada Hills, CA 4,224,565 A 9, 1980 Sosniak et al.
(US); James D. Causey, III, Simi Valley, 4,636,920 A * 1/1987 Cook et al. ................. 361,810
CA (US); Jay A. Yonemoto, Arcadia, 4,698,582 A 10, 1987 Braun et al.
CA (US) 5,207,666 A 5/1993 Idriss et al.
5,381.304 A 1/1995 Theroux et al.
(73) Assignee: Medtronic Minimed, Inc., Northridge, 5,592,121 A 1/1997 Jung et al.
5,699,231 A 12/1997 Elatem et al.
CA (US)
(*) Notice: Subject to any disclaimer, the term of this (Continued)
patent is extended or adjusted under 35 FOREIGN PATENT DOCUMENTS
U.S.C. 154(b) by 0 days. EP O 401 940 12/1990
This patent is Subject to a terminal dis
claimer. (Continued)
(21) Appl. No.: 11/702,713 Primary Examiner Stephen W. Jackson
(74) Attorney, Agent, or Firm Foley & Lardner LLP
(22) Filed: Feb. 5, 2007 (57) ABSTRACT
(65) Prior Publication Data
A selectively protected electrical system includes or operates
US 2007/0159.755 A1 Jul. 12, 2007 with a power source, a load, a power driver circuit for con
trollably transferring power from the power source to the
Related U.S. Application Data load, the power driver circuit being encapsulated in a potting
(60) Division of application No. 10/815,183, filed on Mar. material, and a controller for enabling and disabling the
31, 2004, now Pat. No. 7,187,528, which is a continu power driver circuit, the controller being un-encapsulated by
ation of application No. 10/013,943, filed on Dec. 8, the potting material. If a contaminant induced electrical fault
2001, now Pat. No. 6,801,420, which is a continuation occurs in the selectively protected electrical system, the elec
in-part of application No. 09/838,699, filed on Apr. 19, trical fault is more likely to occur in the un-encapsulated
2001, now abandoned. controller, such that the selectively protected electrical sys
tem is disabled. The contaminant is inhibited from contacting
(51) Int. Cl. and inducing an electrical fault in the power driver circuit,
HO2H 3/00 (2006.01) thus providing for a controlled failure of the selectively pro
(52) U.S. Cl. ...................................................... 361A1 OO tected electrical system.
(58) Field of Classification Search .................. 361/100
See application file for complete search history. 23 Claims, 13 Drawing Sheets
2OO
202
STEPUP
CONVERTER 20
US 7.460,350 B2
Page 2
U.S. PATENT DOCUMENTS FOREIGN PATENT DOCUMENTS

5,790, 108 A 8, 1998 Salcudean et al. JP 06-01-1241 1, 1994
5,814,090 A 9, 1998 Latterell et al. JP 08-334098 12/1996
5,821,715 A 10/1998 Plutowski et al. JP 2000-282749 10, 2000
6,265,851 B1 7/2001 Brien et al. JP 2001-020601 1, 2001
6,286,566 B1 9/2001 Cline et al. JP 2001-124346 5, 2001
6,452,198 B1* 9/2002 Mani et al. ............. 250,492.21
6,801,420 B2 * 10/2004 Talbot et al. ................ 361/100 * cited by examiner
U.S. Patent Dec. 2, 2008 Sheet 1 of 13 US 7.460,350 B2
O
116 /
STEPUP 118
CONVERTER
+
1.2W -R- O 12Y
?
FIG. 1
202 - ----- - -- - -- - -
STEPUP
CONVERTER
U.S. Patent US 7.460,350 B2
00||
/90/ Z0/(?)
C/
C
O CMO
O Ps
vaul C
C O
E
v i
O Ce
nH
r N
O CD
m -
ul LL
A
C O
CP CP
C/O b
(MO
an ars
H. CN
-- - - - - - - - - - - - - - - - .. .. .
C/O
C
O
O
y
C
E
O
N
H
CD
H
LU
d
O
C-9
CMO
-
era.
n
ah
F | | | | | | || 3: - - - - - - - - - - - -
my
us
de
--
re-sw-as-a-r-ass series-as re-rrow-r-----esproos-sara---------ressssssssssa assssor a -
ress ross---ass------scr-s-a-sa-as-s-s-s-s-s-s-s-s-+
surrorss swoosaurusers assassry possss sususness re-as-s-s-a-vsgs.gpa or
9I?I
W(BIVESAHON3|-
Power
Driver
Circuit 58
1516 Controller
1606
1604
Power
1602 Driver
Circuit
F.G. 16
1806 1808 1800
POWER
CONTROLLER SUPPLY
LOAD 1810
1802
SWE
CIRCUIT
F.G. 18
1906 1908
CONTROLLER POWER
SUPPLY
LOAD 1910
POWER
DRIVER
CIRCUIT
F.G. 19
US 7,460,350 B2
1. 2
SELECTIVE POTTING FOR CONTROLLED As discussed above, conventional drug delivery systems
FAILURE AND ELECTRONIC DEVICES Such as infusion pumps are examples of systems wherein a
EMPLOYING THE SAME failure of the systems electronics may have serious conse
quences. An infusion pump system can include electronic
CROSS-REFERENCE TO RELATED PATENT 5 control circuits and electronic power driver circuits, as well as
APPLICATIONS other circuitry. The control electronics can control the power
driver circuit to drive a motor which, in turn, drives the infu
This application is a Divisional of U.S. application Ser. No. sion pump. One Such drug delivery system is used to deliver
10/815,183, filed Mar. 31, 2004 now U.S. Pat. No. 7,187,528, insulin over a period of time and utilizes a variety of motor
incorporated herein by reference in its entirety, which is a 10 technologies to drive an infusion pump. Typical motor tech
Continuation of U.S. application Ser. No. 10/013,943, filed nologies include direct current (DC) motors, stepper motors,
Dec. 8, 2001 now U.S. Pat. No. 6,801,420, incorporated or Solenoid motors. Each motor type has various advantages
herein by reference in its entirety, which is a Continuation and disadvantages related to cost, reliability, performance,
In-Part of U.S. application Ser. No. 09/838,699, filed Apr. 19, weight, and safety.
2001 now abandoned, incorporated herein by reference in its 15 In drug delivery using infusion pumps, the accuracy of
entirety. medication delivery can be critical (such as for insulin, HIV
FIELD OF THE INVENTION drugs or the like), since minor differences in medication
quantity can dramatically affect the health of the patient.
Thus, safeguards must be designed into the delivery system to
This invention relates to a system and method for con protect the patient from over or under delivery of medication.
trolled failure in electronic devices and, in particular embodi For example, in the case where insulin is administered via an
ments, to selective potting for controlling failures in defined infusion pump to a diabetic patient, excessive drug delivery
operations such as controlled failure of a pump driver for could cause complications due to hypoglycemia, and could
delivery of medication or drugs to a patient. possibly even result in death. Therefore, controlled delivery
25
BACKGROUND OF THE INVENTION
with safeguards against over-delivery of medications is
required for drug delivery systems when over-delivery could
result in complications, permanent damage, or death of the
There are many types of electronic devices (medical patient.
devices, sensing devices, and the like) that can fail due to In conventional systems, these safeguards against over
moisture or other environmental contaminants coming into 30
delivery have been incorporated into the drive systems of
contact with the device electronics. A common mechanism is
the addition of water to contaminants that combine to form infusion pumps in varying ways. For example, the motor
ionic solutions that are conductive and may lead to failure of control electronics utilize cross checks, encoder counts,
the electronic device. The failure of such devices may have, in motor current consumption, occlusion detection, or the like,
Some cases, serious consequences for users of systems which 35
as a form offeedback to guard against over or under delivery
contain the devices. For example, if the device is used in a of medication. However, one drawback to this approach can
occur if the control electronics in a DC motor driven infusion
medical system such as an infusion pump for the delivery of
medications/drugs, a failure of the device may lead to acci pump were to fail, such that a direct short occurs from the
dental over-delivery of the medications/drugs, possibly power source to a DC motor in the infusion pump. For
resulting in injury or death. 40
example, in one failure mode, it would be possible for the DC
One common manner of protecting electrical and elec motor to drive continuously for an excessive period of time,
tronic components and circuits in Such systems against con for example, until the power source was depleted or removed,
tact with moisture or other environmental contaminants or until the short was removed. This condition is commonly
involves covering the electronics of such systems with potting referred to as motor “run away', and could result in all of the
materials that are resistant to contaminants such as moisture. 45 medication contained in the infusion pump being infused
One drawback of this method is that known potting materials immediately over too short a period of time resulting in injury
can fail to protect the electrical system against long-term or death to the patient.
contaminant penetration. For example, over time, moisture To avoid this drawback, some infusion pump manufactures
may diffuse through the potting material, where the pen have avoided the use of DC motors and have instead utilized
etrated moisture will likely detrimentally affect the perfor 50 solenoid or stepper motor technologies. With these motor
mance of the electrical system and may lead to unpredictable types, any short in the control electronics, would only result
and possibly dangerous system failures. Also, the potting in, at most, a single motor step. Therefore, motor “run away’
materials may degrade, separate or pull away from and would not occur. Thus, this minimizes the risk of a “runaway”
expose the electrical and electronic components and circuits, failure. However, a drawback to the use of solenoid or stepper
which may reduce the effectiveness of the protection by 55 motor technologies is they generally have a less efficient
exposing the various components and system to contami performance with regard to battery energy, tend to cost more
nantS. as compared to the DC motors, and may only be capable of
The contaminant may pass by or diffuse through the pot running in one direction (i.e. not reversible).
ting material that covers particular electrical or electronic
components which may be “critical because they affect a 60 SUMMARY OF THE DISCLOSURE
critical operation of a system (i.e., the failure of which may
have serious consequences). Such critical operations may It is an object of embodiments of the present invention to
include, for example, electronics for controlling a motor that, provide a system and method of selectively protecting elec
for example drives an infusion pump for delivering a medi trical and/or electronic components or circuits within a par
cation to a patient. A resulting failure of critical electrical or 65 ticular system to provide for controlling a system failure in a
electronic components due to contact with a contaminant may manner where the likelihood of a failure that causes damage
have serious consequences such as those described above. or an undesired (or dangerous) condition is reduced.
US 7,460,350 B2
3 4
Embodiments of the invention employ a selective potting enable state independently of controlling the first voltage
system and method for this purpose. According to embodi potential on the first voltage potential DC power line. The
ments of the present invention, critical electrical and elec safety circuit is operatively coupled to at least one of the first
tronic components and/or circuits of a system are encapsu and second voltage potential DC power lines to inhibit DC
lated in a potting material. Non-critical components of the flow and operation of the DC driven device when the safety
system may remain un-encapsulated. The un-encapsulated circuit is in the disable state and to permit DC flow and
non-critical components are selected to be components that operation of the DC driven device when the safety circuit is in
are likely to contact a contaminant and fail in a predictable or the enable state such that the operation of the DC driven
desired manner. Thus, the failure of the non-critical compo device will occur when the safety circuit is in the enable state.
nents may disable the protected system in the event that the 10 In preferred embodiments, the DC driven device is a DC
system becomes contaminated. Accordingly, the system may motor in an infusion pump. Alternatively, the DC driven
be disabled before the critical electrical and electronic com device is a gas generator in an infusion pump. In preferred
ponents and/or circuits can be contacted by the contaminant, embodiments, the safety circuit is controlled by an AC signal
which could then fail in a manner that would be undesirable, from the controller such that the safety circuit is enabled by
dangerous, or damaging to the system. It is the purpose of the 15 the AC signal to permit DC flow and enable the forward
invention to control the failure of a system by deliberately motion of the DC motor while the AC signal is provided by
exposing components of the system to contaminant failure the controller.
while protecting other system components. Embodiments of In embodiments that utilize a DC motor with a safety
the invention may be employed in various electrical and elec circuit, the safety circuit being in the disable state operates to
tronic systems, including control systems, guidance systems, inhibit the forward motion of the DC motor when the differ
navigation systems, fusing systems, acquisition and tracking ence of the first Voltage potential relative to second Voltage
systems, command systems, sensor Systems, power systems, potential is positive. In addition, the safety circuit being in the
communication systems, computer systems, network sys disable state is inoperative to inhibit a reverse motion of the
tems, processors, or the like, and particularly, automotive and DC motor when the difference of the first voltage potential
aircraft control systems, sensors and other monitoring 25 relative to second Voltage potential is negative. Alternatively,
devices, military systems for ordinance delivery, medical or in addition to, the safety circuit being in the disable state
devices, computers, personal digital assistants (PDAs), and operates to inhibit a reverse motion of the DC motor when the
the like. difference of the first voltage potential relative to second
One embodiment of the present invention is employed in a Voltage potential is negative. In addition, the safety circuit
fluid delivery system including an infusion device for deliv 30 being in the disable state operates to inhibit the forward
ering a medication/drug/fluid. An example infusion device is motion of the DC motor when the difference of the first
driven by a DC motor. The DC motor may also include safety Voltage potential relative to second Voltage potential is nega
enhancements such as safety circuits, which obviate, for prac tive. Further, the safety circuit being in the disable state is
tical purposes, the above mentioned limitations. inoperative to inhibit a reverse motion of the DC motor when
According to an embodiment of the invention, a selectively 35 the difference of the first voltage potential relative to second
protected electrical system includes or operates with a power Voltage potential is positive. Alternatively, the safety circuit
Source, a load, a power driver circuit for controllably trans being in the disable state operates to inhibit a reverse motion
ferring power from the power source to the load, the power of the DC motor when the difference of the first voltage
driver circuit being encapsulated in a potting material, and a potential relative to second Voltage potential is positive.
controller for enabling and disabling the power driver circuit, 40
Preferred embodiments are directed to an infusion pump,
the controller being un-encapsulated by the potting material. in which the safety circuit is used to prevent operation of the
If a contaminant induced electrical fault occurs in the selec DC motor during a controller failure to prevent accidental
tively protected electrical system, the electrical fault is more delivery of excess fluid. In particular embodiments, the safety
likely to occur in the un-encapsulated controller, Such that the circuit is integral with the DC motor. In other embodiments,
selectively protected electrical system is disabled. The con 45 the safety circuit is co-located with the controller.
taminant is thus inhibited from inducing an electrical fault in Other features and advantages of the invention will become
the power driver circuit. Other embodiments may employ apparent from the following detailed description, taken in
other types of drive motor circuits having critical and non conjunction with the accompanying drawings which illus
critical components. Selective protection in accordance with trate, by way of example, various features of embodiments of
embodiments of the invention may be used in combination 50 the invention.
with embodiments of the safety circuit system or in the alter
native. BRIEF DESCRIPTION OF THE DRAWINGS
According to other embodiments of the invention, a safety
circuit system for a DC driven device for use with a fluid A detailed description of embodiments of the invention
delivery system includes a first voltage potential DC power 55
will be made with reference to the accompanying drawings,
line, a second Voltage potential DC power line, a controller wherein like numerals designate corresponding parts in the
and a safety circuit. The first voltage potential DC power line several figures.
is coupled to provide a first voltage potential to the DC driven FIG. 1 is a schematic diagram of a safety circuit in accor
device, and the second voltage potential DC power line is dance with a first embodiment of the present invention.
coupled to provide a second voltage potential to the DC 60
driven device such that the second voltage potential is differ FIG. 2 is an illustrative schematic diagram of a safety
ent relative to the first potential. The controller controls at circuit in accordance with a second embodiment of the
least the first Voltage potential on the first Voltage potential present invention.
DC power line. The safety circuit has an enable state and a FIG. 3 is a schematic diagram of a safety circuit in accor
disable state, in which the default state is the disable state. The 65 dance with a third embodiment of the present invention.
safety circuit is coupled to the controller, and the controller FIG. 4 is a schematic diagram of a safety circuit that is a
controls the safety circuit to place the safety circuit in the variation of the embodiment shown in FIG. 3.
US 7,460,350 B2
5 6
FIG. 5(a) is a schematic diagram of a safety circuit that is electrical and/or electronic components and/or circuits may
a further variation of the embodiment shown in FIG. 3. include covering one or more electrical and/or electronic
FIG.5(b) is a top view of a pin out diagram for a component components and/or circuits with a potting material on one or
used in the circuit shown in FIG. 5(a). more sides. It may include partially or fully covering the
FIG. 5(c) is a top view of a pin out diagram for another 5 electrical and/or electronic components and/or circuits.
component used in the circuit shown in FIG. 5(a). Embodiments of the present invention selectively encapsu
FIG. 6 is a schematic diagram of a safety circuit that is yet late in a potting material a critical portion or portions of a
another variation of the embodiment shown in FIG. 3. particular electrical or electronic system. A critical portion of
FIG. 7 is a perspective view of a motor in accordance with a system may contain critical components for performing a
an embodiment of the present invention. 10 critical operation. Critical components of an electrical or
FIG. 8 is a simplified schematic of a motor and safety electronic system include components that, failing, may
circuit in accordance with an alternative embodiment of the cause undesirable, dangerous, and/or damaging operation of
present invention. the system. Critical portions of a particular system may
FIG. 9 is a waveform diagram illustrating operation of the include, for example, electronic circuits or circuit compo
safety circuit and power Supplied to a DC motor in accor 15 nents for controlling a load. A load may include a motor, an
dance with the embodiments of the present invention. actuator, a hydraulic system, a pneumatic system, a pump, a
FIG. 10 is a waveform diagram illustrating operation of the compressor, a turbine, a generator, a valve, and the like. A
safety circuit and power Supplied to a DC motor that is an load may perform a critical operation Such as automobile
enlarged view of the portion shown in the dashed circle 10-10 braking. Critical portions of a particular system may further
of FIG. 9. include electronic circuits or circuit components employed in
FIG. 11 is a waveform diagram illustrating operation of the an avionics system for critical operations such as controlling,
safety circuit and power Supplied to a DC motor that is an for example, an aileron, rudder, or elevator used to control or
enlarged view of the portion shown in the dashed circle 11-11 guide an aircraft or missile. Further examples include elec
of FIG. 9. tronic circuits or circuit components used in medical systems
FIG. 12 illustrates a schematic diagram of a printed circuit 25 for controlling devices such as infusion pumps for performing
board used in a drive system for a DC motor in accordance critical operations such as medication/drug delivery, sensors
with an embodiment of the present invention. and monitors for critical operations such as sensing or moni
FIG. 13 illustrates a simplified schematic diagram of an toring a patients condition, and pacemakers for critical
embodiment of a power driver circuit used in a drive system operations such as stimulating or controlling a patient’s heart
for a DC motor in accordance with an embodiment of the 30 contraction rate. Critical components may be found in other
present invention. devices Such as control systems, guidance systems, naviga
FIG. 14A illustrates a schematic circuit diagram of a drive tion systems, fusing Systems, acquisition and tracking sys
system for a DC motor in accordance with an embodiment of tems, command systems, sensor systems, power systems,
the present invention. communication systems, computer systems, network sys
FIG. 14B illustrates an ASIC chip for implementing a 35 tems, processors, or the like, and particularly, automotive and
safety circuit in accordance with an embodiment of the aircraft control systems, sensors and other monitoring
present invention. devices, military systems for ordinance delivery, medical
FIG. 15 illustrates a simplified schematic circuit diagram devices, computers, personal digital assistants (PDAs), and
of a dissolvable switch or circuit used to shut-off power to a the like, where controlled failure or desired or predicable
power driver circuit in accordance with an embodiment of the 40 disablement is desired or required. Non-critical components
present invention. of an electrical or electronic system include components that,
FIG. 16 illustrates a simplified partial schematic circuit failing, may cause disablement or a predictable (or desired)
diagram of a dissolvable fuse, switch, or circuit used with the failure of the device or system, but are not likely to cause
power driver circuit in accordance with an embodiment of the undesirable operation of the electrical or electronic system.
present invention. 45 Example embodiments of the present invention include a
FIG. 17 illustrates a simplified partial schematic circuit power Supply, a power driver circuit, a controller, and a load.
diagram of a dissolvable fuse, Switch, or circuit used with a The power Supply includes one or more batteries, generators,
DC motor, or the like, in accordance with an embodiment of alternating current (AC) or direct current (DC) supplies, elec
the present invention. trical power Sources, and the like. The power Supply provides
FIG. 18 illustrates a simplified schematic circuit diagram 50 power to the power driver circuit. The power driver circuit is
of a dissolvable fuse, Switch, or circuit used to carry a con connected to the load, and the load is connected to the power
troller signal in accordance with an embodiment of the Supply completing the circuit. The controller provides signals
present invention. to the power driver circuit to cause the power driver circuit to
FIG. 19 illustrates a simplified schematic circuit diagram connect or disconnect power from the power Supply to the
of a dissolvable fuse, Switch, or circuit used in a power 55 load.
carrying portion of a circuit, in accordance with an embodi Preferred embodiments of the present invention are
ment of the present invention. described in relation to a fluid delivery system for the delivery
of a medication/drug. However, other embodiments may be
DETAILED DESCRIPTION OF THE PREFERRED employed in other electrical and electronic systems having
EMBODIMENTS 60 critical and non-critical components.
One embodiment is described in relation to a fluid delivery
As shown in the drawings for purposes of illustration, the system using an infusion pump driven by a DC motor. In one
invention is embodied in a system and method for selectively embodiment, the DC motor is driven by a power driver circuit
encapsulating or potting particular electrical and/or elec comprising an H-bridge configuration of switching elements.
tronic components and/or circuits which provides for control 65 Other embodiments may employ other suitable power driver
ling a system failure in a manner where the likelihood of a circuits, such as those described below. The power driver
critical failure is reduced. Encapsulating or potting particular circuit is controlled by a controller including control electron
US 7,460,350 B2
7 8
ics and/or at least one microprocessor. One or more batteries one skilled in the art will understand that embodiments of the
supply power to the power driver circuit. The power diver present invention may be used in many other electrical or
circuit connects or disconnects the power to the DC motor electronic systems as well to avoid malfunctions of electronic
when commanded by the controller. circuits and/or false readings of a sensor or monitor. For
In one embodiment, the power driver circuit is a critical example, the sensor systems might be used with blood glu
component and the controller is a non-critical component. cose meters, continuous glucose monitors, heart rate moni
The power driver circuit is selectively potted and the control tors, oxygen sensors, or the like. The sensors may be used to
ler is left un-potted. Thus, if the system comes in contact with monitor or adjust therapies. Controlled failure and/or disable
a contaminant, an ionic contaminant for example, the con ment of the sensors may be required to avoid ill-informed
troller is likely to fail and disable the system before the power 10 therapy adjustments that might lead to adverse results for a
driver circuit can come in contact with the contaminant, thus patient. Also, embodiments of the present invention may be
reducing the possibility of inadvertently powering the load, employed in control systems, guidance systems, navigation
which in particular embodiments is a motor. systems, fusing systems, acquisition and tracking systems,
In other embodiments, the power driver circuit is a critical command systems, sensor Systems, power systems, commu
component and the power Supply is a non-critical component. 15 nication systems, computer systems, network systems, pro
The power driver circuit is selectively potted and the power cessors, or the like, and particularly, automotive and aircraft
Supply is left un-potted. Thus, if the system comes in contact control systems, sensors and other monitoring devices, mili
with a contaminant, the power Supply is likely to fail and tary systems for ordinance delivery, medical devices, com
disable the system before the power driver circuit can come in puters, personal digital assistants (PDAs), and the like. In
contact with the contaminant, thus reducing the possibility of fact, embodiments of the present invention may be employed
inadvertently powering the load. in any electrical or electronic system wherein it is advanta
In particular embodiments, leads, traces, or the like from geous to provide for a controlled failure of the system.
each pole of the power Supply are left exposed in close proX As discussed above, embodiments of the present invention
imity to each other so that a contaminant can cause a short may be employed in a fluid delivery system including an
circuit between the leads, thus removing or diminishing 25 infusion drive mechanism for delivering a medication, drugs,
power to the power driver circuit and/or the DC motor or other and/or fluid. Embodiments of the present invention may fur
loads. In alternative embodiments, a fuse is included between ther employ, in addition to selective potting, a safety circuit
the power supply and one or more of the exposed leads. When employed to inhibit accidental over-delivery of medications/
the two or more leads from the power supply are shorted drugs due to DC motor control circuit failures.
together due to a contaminant, the fuse is blown thus remov 30 Some embodiments of safety circuits are first described so
ing power. The fuse is protected from contamination so that that a later description of embodiments of the selective pot
the contamination cannot short across the fuse. ting system and method may be fully understood with regard
In some embodiments, a safety circuit for the DC motor, to the circuits described therein. However, it should be under
which inhibits accidental over delivery of medications/drugs stood that embodiments of the invention might be practiced or
is employed, alternatively or in addition to, selective potting 35 used without or in addition to the safety circuits described
is used to protect selected components of the fluid delivery below. The safety circuits are being merely provided as one
system from contamination. example to demonstrate an improvement that utilizes selec
In further embodiments, one or more dissolvable circuit tive potting, and the present invention should not be limited to
elements, such as fuses, may be employed, alternatively or in the selective potting of these particular circuits described
addition to, selective potting. The one or more dissolvable 40 below.
circuit elements may dissolve when contacted by a contami In preferred embodiments of these safety circuits, a con
nant and, for example, open a circuit path. Once one or more troller provides a signal to a safety circuit, in addition to
of the dissolvable circuit elements dissolve, the system may providing power for the DC motor in an infusion pump, that
be disabled before the power driver circuit comes in contact enables the DC motor to operate only when an enabling signal
with the contaminant. In further embodiments, the one or 45 is provided to the safety circuit. However, it will be recog
more dissolvable circuit elements dissolve in a manner that nized that further embodiments of the invention may be used
reduces the resistance of the electrical path that it covers and to inhibit motor operation with additional signals or by con
causes the circuit path to fully close and act as a short. trolling other aspects of the infusion pump. The safety circuits
Yet other embodiments of the present invention may are primarily adapted for use in infusion pumps that deliver
employ one or more contaminant sensing elements, such as 50 medication (or fluid) to Subcutaneous human tissue. How
humidity sensors, alternatively or in addition to, selective ever, still further embodiments may be used with infusion
potting. The one or more contaminant sensing elements may pumps for other types of tissue, such as muscle, lymph, organ
be left un-encapsulated by potting material Such that a con tissue, veins, arteries or the like, and used in animal tissue.
taminant may be sensed by the contaminant sensing elements The infusion pumps are also primarily for external use; how
before the contaminant may contact other portions of the 55 ever, alternative embodiments may be implanted in the body
electrical system. In one embodiment, the one or more con of a patient. The fluid delivery systems are also primarily for
taminant sensing elements may communicate with a control delivery of medication, drugs and/or fluids to a patient; how
ler or other device operative to produce a user-perceptible ever other embodiments may be used with other fluid delivery
signal. Such as an audible alarm, vibration, shock, optical systems that require a high degree of confidence that a DC
indication, a display, transmitting a signal to another device, 60 motor “run away' will not occur, such as in certain manufac
or the like, to alert a user that a contaminant has been sensed turing techniques or the like. Preferred embodiments are
within the system. In another embodiment, the one or more directed to safety circuits for DC motors. However, alterna
contaminant sensing elements may be operative to safely shut tive embodiments may be used with other DC driven devices,
down the electrical system once a contaminant has been Such as a DC activated gas generator in an infusion pump or
sensed. 65 the like.
Although embodiments of the invention are described in Preferred embodiments are directed to circuits and meth
relation to a medical system for controlling an infusion pump, ods for using DC motor technology in fluid delivery systems
US 7,460,350 B2
10
with additional safety circuits to prevent DC motor “run diode 204. For instance, if the DC motor 208 has 3.0 volt
away”. Use of this technology obviates the need for the use of motor winding and the Zener diode 204 has a breakdown
comparatively less efficient and more expensive stepper voltage of 2.0 volts, the DC-DC step up converter 202 must
motor and solenoid motors. All of the illustrated embodi provide 5.0 volts to facilitate operation of the DC motor 208
ments include a DC motor and some DC motor control elec at its nominal rated voltage, if it is desired to drive the DC
tronics, although other components or DC driven devices may motor 208 at the rated voltage. Thus, in this example, when
be used. The control electronics may be relatively simple, the supply voltage from the battery 206 is stepped up to 5 volts
Such as only including the capability of turning the DC motor as a positive Voltage potential, 2 volts are lost through the
on and off by Supplying power for the duration of a key press, Zener diode 204 and 3 volts are provided for operation of the
or may be more complex using microprocessors having mul 10 DC motor 208. In the reverse direction (i.e. a negative voltage
tiple programmable control profiles utilizing feedback from potential), the DC-DC step up converter 202 only needs to
an encoder, driving current or the like. step up the 1.5 volts supply voltage from the battery 206 to 3
FIG. 1 illustrates a safety circuit 110 in accordance with a volts, since there is little loss through the Zener diode 204 in
first embodiment of the present invention. In this embodi the reverse direction. In an alternative embodiment, a Schot
ment, a DC motor 112 is configured to have a nominal Voltage 15 tky diode 250 (shown in dashed lines in FIG. 2) may be placed
winding that is significantly higher thena Supply Voltage from in parallel with the Zener diode 204 to facilitate a low and
a battery 114. To generate a sufficient voltage to operate the predictable Voltage drop in the reverse direction (i.e., negative
DC motor 112, the safety circuit 110 utilizes a DC-DC step up Voltage potential). Alternatively, if a higher speed rewind
converter 116 (or similar), that includes an integral controller (e.g., more torque) is desired and/or required, the DC-DC step
118, between the battery 114 and the DC motor 112 to drive up converter 202 can still be stepped up to the 5 volts to over
the DC motor 112 at its rated voltage (see FIG. 1). Generally, drive the 3 voltrated DC motor 208. Alternatively, the DC-DC
when a DC motor is supplied with the rated voltage (and also step up converter 202 can provide a range of various Voltage
assuming there is sufficient current available), the DC motor values to drive the DC motor 208 at different ratings in either
will provide a known torque. If, for example, the Supply the forward or the reverse directions.
voltage is halved, then the DC motor will only provide 25 In this embodiment, if the integral control electronics 210
approximately half the full Voltage output torque. However, a failed and caused a direct short between the battery 206 and
two, or more, times DC-DC step up converter could be uti the DC motor 208 with the reversed biased Zener diode 204
lized between the battery and the DC motor to provide the (or a reversed biased Zener diode 204 in parallel with a
rated voltage to the DC motor. Thus, to provide a safety Schottky diode 250), the DC motor 208 would not operate in
circuit, the nominal motor Voltage winding is selected to be 30 the forward direction (i.e., there would be no drug delivery),
Some large multiple of the Supply Voltage from the battery, and would have only a fraction of the rated torque in the
such as ten times, or the like, higher then the supply voltage rewind direction (or no rewinding if sufficient friction is
from the battery. Therefore, if the battery 114 is shorted present in the drive mechanism). For additional safety, alter
directly to the DC motor 112 (i.e., as when there is an control native embodiments of the safety circuit 200 would include
electronics 118 failure and/or DC-DC step up converter 116), 35 the DC-DC step up converter 202 such that it would only be
the DC motor's 112 output torque would only be approxi enabled by an additional internal signal S2 (shown in dashed
mately /10 of the rated value. lines) from the control electronics 210. Thus, if the control
Generally, if the friction in the complete drive system (e.g., electronics 210 were to fail, there would be no enable signal
drive gears, shaft, or the like) is approximately /10 of the to provide the required step up voltage to drive the DC motor
nominal rated value, the DC motor 112 will not have enough 40 208 in a “run away” condition. In preferred embodiments, the
available torque to drive the system and cause a "run away’ Zener diode 204 is contained within the DC motor package
condition. To drive the DC motor 112 with sufficient torque, 212 (see also FIG. 7) so that the DC motor 208 is protected
a DC-DC step up converter 116 would be required with independently of the type of control electronics 210 to which
approximately a ten times step up capability. For additional the DC motor 208 is connected. In alternative embodiments,
safety, alternative embodiments of the safety circuit 10 would 45 the Zener diode 204 could be contained within the control
include the DC-DC step up converter 116 such that it would electronics and the electronics are then connected to a con
only be enabled by an additional internal signal S1 (shown in ventional DC motor (see also FIG. 8). In alternative embodi
dashed lines) from the integral control electronics 118. Thus, ments, a second Zener diode may be used, which is reversed
if the control electronics 118 were to fail, there would be no with respect to the first diode and in series with the first diode
enable signal to provide the required step up Voltage to drive 50 such that the DC motor operates similarly in both directions.
the DC motor 12 in a “run away” condition. Alternative In the event of direct short to the DC motor in the reverse
embodiments may utilize different battery supply voltages to direction, the battery voltage would not be enough to run the
rated nominal motor motor 208 in either direction. In further alternatives, the con
Voltages ratios, with the choice being based on system trol electronics 210 may be separated from the DC-DC step
friction, tolerance for movement, cost of control electronics 55 up converter 202 and provided as a discrete element that is
and DC motors, or the like. In further alternatives, the control placed before or after the DC-DC step up converter 202.
electronics 118 may be separated from the DC-DC step up In the first two embodiments, “run away' of the DC motor
converter 116 and provided as a discrete element that is is substantially prevented However, if the system were to fail
placed before or after the DC-DC step up converter 116. Such that a short were maintained between the stepped up
FIG. 2 illustrates a safety circuit 200 in accordance with a 60 voltage from the DC-DC converter to the DC motor and/or the
second embodiment of the present invention that builds upon Zener diode failed, then the potential for motor “run away’
the embodiment shown in FIG. 1. The safety circuit 200 exists with the above embodiments.
utilizes a DC-DC step up converter 202 (that includes integral FIG. 3 illustrates a safety circuit 300 in accordance with a
control electronics 210) and a Zener diode 204. The DC-DC third embodiment of the present invention, which includes
step up converter 202 converts the supply voltage from the 65 further enhancements to provide protection against DC motor
battery 206 to a value corresponding to the sum of the rated 302 “run away”. The safety circuit 300 includes additional
motor winding voltage of the DC motor 208 and the Zener electronics added to the DC motor package (as shown in FIG.
US 7,460,350 B2
11 12
7) that are independent of the control electronics. Alterna FIGS. 5(a)-(c) illustrate a safety circuit 500 in accordance
tively, the additional electronics may be included in the con with a fifth embodiment of the present invention. This safety
trol electronics (as shown in FIG. 8) or as a separate set of circuit 500 is also similar to the embodiment of FIG. 3, but
control electronics (not shown). In preferred embodiments, utilizes FET 502 (IRLM1902 from International Rectifier)
the control electronics must provide a specific signal (atter instead of the FET308, and an additional Schottky diode 504
minal 3) to the additional electronics to allow the DC motor (e.g., BAT54CT-ND from Zetex).
302 to operate. As shown in FIG. 3, the rated supply voltage FIG. 6 illustrates a safety circuit 600 in accordance with a
from the battery (not shown) is supplied to terminals 1 and 2 sixth embodiment of the present invention. This safety circuit
as a negative and positive Voltage potential, respectively, to 600 is similar to the embodiment of FIG. 3, but utilizes FET
control operation of the DC motor 302 in the forward direc 10 606 (IRLM1902 from International Rectifier) instead of the
tion. However, current will not pass through the DC motor FET308, and an additional Schottky diode (e.g., BAT545CT
302 until a specific AC signal (e.g., a 3 volt Peak-to-Peak ND from Zetex). In addition, the capacitors and resistors are
Square wave at approximately 32 kHz—see FIGS. 9-11) is selected to form a bandpass filter to provide better noise
provided to terminal 3 and the safety circuit 300 by the control isolation and circuit performance. Performance of the safety
electronics. This provides a second independent system to 15 circuit 600 as it provides power to the DC motor 604 from a
control the operation of the DC motor 302. For a “run away’ battery 602 is illustrated in FIGS. 9-11.
to occur the control electronics must short the battery to the FIG. 7 illustrates a perspective view of a DC motor package
power terminals 1 and 2, and must also provide an AC signal 700 that includes a safety circuit 702 within the package 700
to terminal 3 of the safety circuit 300. Thus, if a direct short holding a DC motor 704. An advantage to this configuration
does occur between the battery and the power terminals 1 and arises from the fact that the DC motor 704 includes the safety
2 with the safety circuit 300, the DC motor 302 will not circuit 702, which must be connected, and enabled, or the DC
operate, since the required AC signal at terminal 3 is not motor 704 will not operate. This minimizes the possibility
present. Preferably, the safety circuit 300 uses two Schottky that a DC motor 704 will be improperly installed in a fluid
diodes 304 and 306 (e.g., BAT54SCT-ND from Zetex) and a delivery device by assuring that an AC signal must be pro
FET308 ((e.g., IRMLMS 1902 from International Rectifier). 25 vided to the terminal input 3 on wire 706 to enable the DC
In operation, when the control electronics provide a posi motor 704 to operate. In alternative embodiments, as shown
tive DC voltage potential at terminal 2, and a negative Voltage in FIG. 8, the fluid delivery system 800 includes an additional
potential at terminal 1, the DC motor 302 will not operate safety circuit 802 (i.e., in addition to other switches and
since the gate G of the FET308 does not have a positive signal controls found in the control circuitry), which is contained
applied to it derived from the input at terminal 3 of the safety 30 within the control electronics 804. The control electronics
circuit 300. In this situation, the gate G blocks the flow of 804 are then connected to a standard, two-input DC motor
current from the drain D to the source S of the FET 308. DC 806, without the need for an additional connection to the DC
flow through terminal 3 is blocked by the capacitor C1. Thus, motor 806. For instance, the safety circuit 802 operates a
the DC motor 302 will not operate, if there is no AC signal switch 808 to enable power to pass to and drive the DC motor
applied to terminal 3 of the safety circuit 300. 35 806.
When an AC voltage potential signal (e.g., a 3 volt Peak to FIGS. 9-11 illustrate operational waveforms for the safety
Peak square wave at a frequency of approximately 32 kHz— circuit 600 (see FIG. 6) as DC current is applied to the circuit.
see FIGS. 9-11) is applied to terminal 3 of the safety circuit As shown in FIG. 9, when DC current is applied to the DC
300, Schottky diodes 304 and 306 rectify and double the motor 604 in graph section 902, no current is drawn since the
signal to positively bias the gate G, current then flows from 40 AC enable signal in graph section 908 is not present. When
the drain D to the Source S of the FET 308 and to terminal 1. the AC signal is applied in graph section 910, the DC current
This in turn drives the DC motor 302, which is connected to is quickly applied to the DC motor 604 by the battery 602, as
the positive DC voltage potential at terminal 2. In alternative shown by the graph section 904. When the AC enable signal
embodiments, a different number of components, such as is removed, as shown in graph section 912, the DC power
diodes, capacitors, resistors, or the like, may be used. In 45 supplied to the DC motor 604 is cutoff, as shown in graph
addition, the selection of the type of FET, diode, size of the section 906. FIGS. 10 and 11 highlight and expand portions of
Voltage potentials on terminals 1, 2 and 3, the AC signal type FIG.9 to illustrate the AC signal used and the response of the
(including duration of peaks, waveform and frequency), may safety circuit 600. The illustrated AC signal is at approxi
be different, with the selection being dependent on motor mately 3 volts peak-to-peak at a frequency of approximately
nominal operating Voltage, system friction, tolerances, safety 50 32 kHz. However, in alternative embodiments, different
issues, control electronics, or the like. shape waveforms, such as saw tooth, sinusoidal, or the like
In preferred embodiments, the safety circuit 300 uses the may be used. In addition, different Voltage ranges may be
additional AC signal to control the forward operation of the used, with the selection being dependent on the rated motor
DC motor 302, since concerns over DC motor “run away’ output and the application in which the motor is being used.
arise mainly from the possibility of over-delivery of a fluid 55 Further, higher or lower frequencies may be utilized, with the
due to the failure of the safety circuit 300. There is less selection be dependent on the response characteristics of the
concern for the situation, in which the fluid delivery system safety circuit, noise, or the like. The delays observed in FIGS.
rewinds, since no fluid would be delivered in that scenario. 10 and 11 are a result of the smoothing and bandpass filters
However, in alternative embodiments, the drive system may used in the safety circuit 600. For instance it takes approxi
also use an additional signal to control operation of the DC 60 mately 125 microseconds for the DC motor 604 to respond
motor in the rewind direction. after the AC signal is provided, and about 80 microseconds
FIG. 4 illustrates a safety circuit 400 in accordance with a for the DC motor 604 to respond to termination of the AC
fourth embodiment of the present invention. This safety cir signal. One advantage of having the DC current ramp up and
cuit 400 is similar to the embodiment of FIG. 3, but utilizes a down is that it minimizes the effects of Voltage spikes and
BJT 402 (FMMT 491 ACT-ND from Zetex) instead of the 65 electromagnetic interference.
FET 308, and an additional Schottky diode 404 (e.g., Further embodiments may employ alternative or additional
BAT54CT-ND from Zetex). safeguards comprising or including selective potting of cir
US 7,460,350 B2
13 14
cuit portions and/or elements. As is well known, potting mate include a step up converter as described above with respect to
rial protects electrical and electronic components from exter FIGS. 1 and 2. Furthermore, the controller portion may also
nal effects, such as moisture and other contaminants. include a safety circuit such as that described with reference
However, even when generally well-sealed against penetra to FIG. 6. Alternatively, the safety circuit may be integral to
tion by moisture and other contaminants, known potting the DC motor.
materials typically fail to protect the electrical system against FIG. 13 shows a simplified schematic diagram of an
long-term contaminant penetration due to creep, differences embodiment of a power driver circuit 1300 shown as view C
in thermal expansion (heat cycling), poor sealing or adhesion; in FIG. 12. FIG. 13 further shows simplified block diagrams
poor workmanship; degradation of the potting materials of the controller 1302 and safety circuit 1304, illustrating in a
mechanical working, Such as flexing, bending, torquing, 10 simplified manner how they are coupled to the power driver
shear, shock, vibration, tension or compression; or the like. circuit 1300 in one embodiment. In FIG. 13, the controller
For example, moisture diffusion through the potting material 1302 is not co-located with the power driver circuit 1300 on
will likely detrimentally affect the performance of the elec circuit board 1200. In further embodiments, safety circuit
trical system and may lead to unpredictable system failures. 1304 may be co-located with the controller 1302 on the con
As an example, infusion devices like those described above 15 troller portion of circuit board 1200 or may, in other embodi
may employ a drive system including a power driver portion ments, be integral to DC motor 1314. Alternative embodi
and a controller portion. The controller portion provides a ments may be utilized with more or less complicated circuits.
signal to the power driver portion to control the power driver The power driver circuit 1300 shown in FIG. 13 has an
portion. The power driver portion transfers power from a H-bridge configuration including first and second pairs of
power source to the drive system, such as a DC motor, a Switching elements having conducting and non-conducting
powered and/or controlled drive mechanism, or the like, that states. The first and second pairs of Switching elements, as
drives the infusion device. Typical power sources include, but well as the safety circuit 1304 are coupled to the controller as
are not limited to, a battery, power Supply, AC Source, DC represented by the dashed lines. The first pair of switching
source, solar cell, or the like. In one possible failure mode, the elements 1306, 1312 are enabled to be in a conducting state to
moisture may penetrate the potting material covering the 25 conduct a first current from a first terminal of battery 1316,
power driver portion and cause a direct short from the power through the winding of the DC motor 1314 and back to a
source to the drive system. Thus, it would be possible for the second terminal of battery 1316, when a first signal is
drive mechanism to run away. As a result, all of the medica received from the controller 1302. If the controller 1302 also
tion contained in the infusion device may be infused over too sends an enable signal to the safety circuit, a first current will
short a period resulting in injury or death to the patient. 30 be established in the winding of the DC motor 1314 and the
However, in another possible failure mode, the contaminant motor may turn in a first direction.
may first penetrate the potting material covering the control The second pair of Switching elements 1308, 1310 are
ler portion of the drive system and/or the power source. If an enabled to be in a conducting state to conduct a second current
electrical fault, a short-circuit for example, occurred in the from the first terminal of battery 1316 through the winding of
controller portion as a result, the likelihood of drive system 35 the DC motor 1314 and back to the second terminal of battery
runaway may be reduced. This is because the controller por 1316 through the winding of the DC motor 1314 when a
tion and/or power source of the drive system may become second signal is received from the controller 1302. If the
disabled before the contaminant penetrates and short-circuits controller 1302 also sends an enable signal to the safety
the power driver portion of the drive system, which would circuit, a second current will be established in the winding of
prevent power from reaching the DC motor even if the power 40 the DC motor 1314 and the motor may turn in a second
driver portion provides a current path due to short-circuits. direction. Thus, bi-directional current flow is established in
Thus, by selectively potting critical circuit portions or ele the stator winding since the first current is in a direction
ments, an electrical fault may be selectively isolated to a through the winding that is opposite from the direction of the
predetermined portion, element, or circuit path within an second current.
electrical or electronic system, or at least the electrical fault 45 It can be seen from FIG. 13 that if a contamination induced
will occur in the un-potted non-critical portion, element, or short circuit occurs in the power driver circuit 1300 where
circuit before an electrical fault develops in a potted critical either the first or second pair of switching elements are short
portion, element, or circuit. In this manner, a failure of that circuited, it would be possible for the DC motor 1314 to run
system may be controlled to occur in a non-critical portion of away. It can also be seen from FIG. 13 that the first and second
the system. In other words, a non-critical portion of the sys 50 pairs of switching elements are enabled and disabled by the
tem may be left exposed to any contaminants such that the controller 1302. Thus, according to one embodiment of the
system fails in a defined or safe manner, Such as turning the present invention, the controller 1302 is un-potted and is thus
infusion device (and/or drive system) off indicating that a more likely to be exposed to a contaminant and become
failure and/or leak has occurred, placing the device in a stable disabled prior to the contaminant shorting the first or second
unalterable operational state, or the like. 55 pairs of H-bridge switching elements. Once the controller
FIG. 12 illustrates a schematic diagram of an embodiment 1302 is disabled, the controller fails to provide enable signals
of a printed circuit board 1200 used in a drive system for a DC to the first or second pair of switching elements and/or to the
motor 1202. DC motor 1202 may be used, for example, in a safety circuit 1304. Therefore, the drive system may be dis
medical infusion device. The portion of circuit board 1200 abled before the first and/or second pairs of switching ele
enclosed in the dashed lines and designated as view C com 60 ments can be short circuited, thus protecting against DC
prises a portion of the drive system used as a power driver motor run away.
circuit for transferring power from a power source (not Possible effects of a contamination induced short circuit on
shown) to the DC motor 1202. The remainder of circuit board the power driver circuit of FIG. 13 are described in more
1200 comprises a controller portion of the drive system used detail with reference to FIG. 14A. FIG. 14A illustrates a
for enabling and disabling the power driver circuit. The con 65 schematic diagram of a component level view of one embodi
troller portion may include control electronics and/or one or ment of a drive system as shown in FIG. 13, including a DC
more microprocessors. The controller portion may further motor 1408, an H-bridge configuration of switching elements
US 7,460,350 B2
15 16
1414, 1420, 1440, and 1442, a controller 1402, and a power in the forward direction. Similarly, a short circuit condition
source 1404, 1406. For the sake of clarity, it will be assumed may occur that causes a short across the source and drain
when describing the operation of the power driver circuit terminals of switching element 1434. If this condition occurs,
shown in FIG. 14A that the DC motor 1408 is a normal DC switching element 1434 will be bypassed, and one entire arm
motor and not a safety motor. Therefore, a safety circuit, Such 5 of the H-bridge will be turned on and the DC motor will move
as the safety circuit 1304 shown in FIG. 13, is not shown in the in the reverse direction.
circuit in FIG. 14A. It should be understood, however, that if Possible short circuit conditions that may occur in the drive
a safety motor were used in place of a normal DC motor, system and may lead to disabling the drive system before DC
forward motion of the DC motor 1408 in the following motor run away can occur will now be described. A contami
description of FIG. 14A would not occur unless the condi 10 nation induced short circuit condition may occur that shorts
tions of the safety circuit were met as described above with point 1428 to ground 1403.
regard to various embodiments of the safety circuit. An exem If this condition occurs, switching element 1430 cannot
plary embodiment of a safety circuit 1405 may be imple turn on and the drive circuit will be disabled in the forward
mented in an ASIC chip 1405 having a crystal oscillator 1438, direction. Similarly, a short circuit condition may occur that
as shown in FIG. 14B. 15 shorts point 1432 to ground 1403. If this condition occurs,
Referring again to FIG. 14A, the portion of the drive sys switching element 1434 cannot turn on and the drive circuit
tem enclosed within dashed line 1401 represents one embodi will be disabled in the reverse direction.
ment of the H-bridge configuration of Switching elements and An additional contamination induced short circuit condi
associated components corresponding to the generalized tion may occur that shorts the crystal oscillator 1436 of the
illustration of the power driver circuit shown in FIG. 13. The motor micro-controller 1402. If this condition occurs, motor
controller (corresponding to controller 1302 of FIG. 13) micro-controller 1402 may not operate to activate motor con
includes a motor micro-controller 1402 having a crystal oscil trol signals. Another contamination induced short circuit con
lator 1436. The power source comprises a battery 1404 and dition may occur that shorts battery 1404. If this condition
motor power supply 1406 coupled to the power driver circuit occurs, there will be no power to the motor power supply
to provide power to DC motor 1408. In one embodiment, the 25 1406 and the drive system will be disabled.
power supply output 1410 of motor power supply 1406 is set A further contamination induced short circuit condition
to 2 volts for forward mode and is set to 5 volts for reverse may occur that shorts power Supply output 1410 to ground
mode. Due to the configuration of the power Supply, the 1403. If this condition occurs, power cannot be supplied to the
battery 1404 voltage is present at the power supply output motor and the drive system will be disabled.
1410 when motor power supply 1406 is disabled. Thus, 30 Yet another contamination induced short circuit condition
unless the battery is removed or shorted, a minimum Voltage may occur in a safety motor embodiment that shorts crystal
of about 1.5 volts is present at power supply output 1410. oscillator 1438 of the safety circuit 1405. In a safety motor
Various possible short circuit conditions may occur in a embodiment, if this condition occurs, the ASIC cannot gen
drive system and may lead to DC motor run away. For erate the safety circuit signal that will allow the safety motor
example, a contamination induced short circuit condition 35 to move, as described above.
may occur which shorts point 1412 to ground 1403. As a As seen from the above description of FIG. 14A, particular
result of this condition, switching element 1414 will be turned short circuit conditions are safer than others, for instance,
on and a first terminal 1416 of DC motor 1408 will be ener several of the short circuit conditions described above may
gized with the Voltage present at power Supply output 1410. disable the DC motor from running, while several others may
Similarly, if point 1418 is shorted to ground 1403, switching 40 result in DC motor runaway. By selectively encapsulating the
element 1420 will be turned on and the other terminal 1422 of portions of the drive system where a short circuit condition or
DC motor 1408 will be energized with the voltage present at other electrical fault may result in motor run away (i.e., the
power supply output 1410. Thus, either of these short circuit portion enclosed by dashed line 1401), embodiments of the
conditions allows power to be supplied to one side of the present invention protect those portions from exposure to
DC motor 1408. If a short circuit also occurs that shorts either 45 contaminants that may cause motor run away, and allow for a
point 1424 or 1426, respectively, to ground 1403, a current controlled, predictable or desired failure of the device.
path is created which will result in the running of DC motor Furthermore, embodiments of the invention leave un-en
1408. capsulated the portions of the drive system, where a short
A further contamination induced short circuit condition circuit condition or other electrical fault is more likely to
may occur that causes a short across the source and drain 50 result in the drive system becoming safely, controllably, desir
terminals of switching element 1414. If this condition occurs, ably or predictably disabled or failed. Thus these un-encap
switching element 1414 will be bypassed and terminal 1416 Sulated portions increase the likelihood that a contaminant
of DC motor 1408 will be energized with the voltage present induced electrical fault occurs first in the un-encapsulated
at power supply output 1410. Similarly, a short circuit con portion, to disable the drive system before the contaminant
dition may occur that causes a short across the Source and 55 can penetrate and short circuit the encapsulated portion.
drain terminals of switching element 1420. If this condition Therefore, embodiments of the present invention provide for
occurs, switching element 1420 will be bypassed and termi a controlled failure of an electrical system, such as the drive
nal 1422 of DC motor 1408 will be energized with the voltage system, or other device as described above.
present at power supply output 1410. If a short circuit also Referring again to FIG. 12, in one embodiment a potting
occurs that shorts either point 1424 or 1426 to ground 1403, 60 material is used to selectively encapsulate the power driver
a current path is created that will result in the running of DC circuit portion of the circuit board 1200 shown in view Cand
motor 1408. schematically in FIGS. 13 and 14A and 14B. In some embodi
Another contamination induced short circuit condition ments, a safety circuit may be integral to the DC motor. In this
may occur that causes a short across the source and drain embodiment the safety circuit may be encapsulated by the
terminals of switching element 1430. If this condition occurs, 65 potting material to protect it from contaminants. In one
switching element 1430 will be bypassed and one entire arm embodiment, the potting material may be any moisture-resis
of the H-bridge will be turned on and the DC motor will move tant potting material Such as, but not limited to parylene, room
US 7,460,350 B2
17 18
temperature Vulcanizing silicone elastomers (RTV's), sili tions (such as the power driver circuit 1804) of the remaining
cone, epoxies, adhesives, plastics, or the like. circuit 1800 are potted for protection. If a contaminant con
In some embodiments, the remainder of circuitboard 1200, tacts the circuit 1800, the dissolvable fuse 1802 would dis
which includes the controller portion, remains un-encapsu solve preventing a signal from a controller 1806 from reach
lated. Thus, when circuit board 1200 is incorporated into the ing the power driver circuit 1804. Without a signal from the
drive system, the controller portion of circuit board 1200, controller 1806, the power driver circuit 1804 will not con
which is un-encapsulated and exposed, may be one of the first nect power from a power supply 1808 to a load 1810. And the
portions of the circuit board 1200 that comes in contact with circuit 1800 is disabled in a safe manner. The dissolvable fuse
any contaminant. After being exposed to a contaminant, the 1802 may be designed to carry very little electrical load and
drive system may become disabled, as a result of an electrical 10 therefore dissolve very quickly since the signal from the
fault induced by the contaminant in the controller portion, controller is likely to beat a relatively low power compared to
which would prevent the controller portion from controlling portions of the circuit 1800 that carry power from the power
the encapsulated power driver circuit before the power driver supply 1808.
circuit is exposed to the contaminant. Therefore, a contami In still further alternative embodiments, as shown in FIG.
nant induced electrical fault, Such as a short circuit condition, 15 19, a dissolvable fuse 1902 may be un-potted while critical
may be controllably isolated to a selected portion of an elec portions (such as the power driver circuit 1904) of the remain
trical system. ing circuit 1900 are potted for protection. If a contaminant
Yet, further embodiments may employ, alternatively or in contacts the circuit 1900, the dissolvable fuse 1902 would
addition to selective potting, one or more dissolvable circuit dissolve preventing power from a power supply 1908 from
elements, such as fuses, located in a current path of electrical reaching the power driver circuit 1904. Even if a controller
systems. For example, a dissolvable circuit element may 1906 continues to send signals the power driver circuit 1904
include a fuse or circuit formed from metallic powder or to provide power to a load 1910, no power will be available.
unidirectional carbon fibers held in a dissolvable matrix, such And even if the power driver circuit were to fail and inadvert
as starch, Sugar, or the like, combinations of contaminant ently try to connect the power supply 1908 to the load 1910,
sensitive materials, or the like, located in series with the 25 still no power would be available to the load 1910.
circuit path from the output 1410 of the motor power supply In still other embodiments, the dissolvable fuse 1902 may
1406 to the power driver be located along line X between the power driver circuit
circuit enclosed within dashed line 1401. (See FIG. 14). 1904 and the load 1910, or along line Y between the load
Thus, if the dissolvable circuit element comes into contact 1910 and the power supply 1908. In fact, one or more dis
with a contaminant, it dissolves and opens the circuit path and 30 solvable fuses may be used between the power supply 1908,
no power is available to run DC motor 1408. Other embodi the power driver circuit 1904, and the load 1910. If any of the
ments may employ any suitable locations or current paths for dissolvable fuses is touched by a contaminant, the portion of
the one or more dissolvable circuit elements. the circuit 1900 that carries power will have at least one open
As shown in the simplified schematic of FIG. 15, in other and thus be disabled.
embodiments, the dissolvable fuse 1502 or circuit is part of 35 It should be understood that in all embodiments that
the power supply portion 1504 of circuit 1500. A switch, employ a dissolvable fuse, that the dissolvable fuse might be
relay, or the like 1510 is be used to provide power from the a fuse, Switch, or circuit.
power supply 1514 to the power driver circuit 1506 (such as In alternative embodiments, the dissolvable fuse or circuit
an H-bridge, or the like) along a power line 1516. The dis may open a circuit under normal conditions, and close the
solvable fuse 1502 or circuit is used to provide a signal to the 40 circuit upon detection of contamination.
relay 1510 along a signal line 1508 to keep the relay 1510 The dissolvable circuit elements may be dissolved by con
closed, and thus, power supplied along the power line 1516. If tact with a particular contaminant, Such as moisture, fluids,
the dissolvable fuse 1502 or circuit dissolves, then the signal oil, particular gases, or the like. In one embodiment, a
on the signal line 1508 is removed, the relay 1510 opens, and selected portion or portions of the electrical system are pot
no power is provided along the power line 1516 to the power 45 ted, and the dissolvable circuit elements are left un-encapsu
driver circuit 1506. Consequently, the power driver circuit lated by potting material. In this manner, the dissolvable
1506 cannot supply power to the load 1512 (such as a motor, circuit elements may be exposed to the contaminant and thus
actuator, pump, or the like) even if a controller 1518 com dissolve and cause an open in the current path which may
mands that the load 1512 be turned-on or if the potted power disable the electrical system before a contaminant induced
diver circuit 1506 later fails and incorrectly tries to provide 50 electrical fault may occur in the selected potted areas. In
power to the load 1512. In this embodiment, the dissolvable another embodiment, only the contaminant dissolvable cir
fuse 1502 or circuit can be thin and easily dissolvable, cuit elements may remain un-encapsulated by the potting
because it carries very little current to keep the power-carry material. The remainder of the electrical system may be
ing relay 1510 closed. encapsulated.
As shown in the partial schematics of FIGS. 16 and 17, in 55 In further alternatives, the dissolvable fuse or circuit may
embodiments that use a dissolvable fuse 1602, 1702 or circuit dissolve upon exposure to excess temperature, light, current,
in a power line 1604, 1704 that actually carry the power, the Voltage, or the like. Thus, contaminants may be solid, gas or
dissolvable fuse 1602, 1702 or circuit must be carefully liquid, oran unacceptable change in electrical state, or physi
designed to dissolve quickly, yet be thick enough to carry the cal state.
current load from a power source 1608, 1708 through a power 60 Still other embodiments may employ, alternatively or in
driver circuit 1606, 1706 to a DC motor 1610, 1710, or the addition to selective potting and/or contaminant dissolvable
like. In further alternatives, the dissolvable fuse 1602 or cir circuit elements, one or more contaminant sensing elements,
cuit may control one or more individual Switches or relays Such as humidity sensors, gas sensors, fluid sensors, pressure
(not shown) that control each of the power pathways in a sensors, temperature sensors, accelerometer, light sensors, or
power driver circuit. 65 the like. In one embodiment, the contaminant sensing ele
In further alternative embodiments, as shown in FIG. 18, a ments may be left un-encapsulated by potting material Such
dissolvable fuse 1802 may be un-potted while critical por that a contaminant may be sensed by the contaminant sensing
US 7,460,350 B2
19 20
elements before the contaminant may contact other portions monitors and systems. The selective potting may be applied to
of the electrical system. In one embodiment, the one or more expose and disable the signals coming from a sensor. For
contaminant sensing elements may comprise one or more instance, in one type of glucose sensor, the signal is measured
pairs of conductive plates or other conductive members sepa as a change in current based upon the interaction of the
rated by a small distance and may be situated in a manner Such glucose molecule with a reagent, oxidase, reactive agent, or
that a contaminant may be received between the plates. Thus, the like, to produce an electrical signal. If the sensor monitor
the contaminant may short a pair of plates together. The is exposed to a contaminant, the signal would be disrupted or
shorting together of the plates may, in one embodiment, com shorted to prevent erroneous signals from reaching the moni
plete a circuit. The completed circuit may then convey, for tor. The sensor may also display an error message, or provide
example, a signal to a controller or other device operative to 10 an indication of failure or system compromise. In still other
shut down the system in a defined or safe manner. Other embodiments, the sensor may be controlled to produce a
embodiments may employ any other Suitable contaminant steady state signal of the last reading along with the indication
sensing elements. of failure or compromise. In other embodiments, the power to
In further embodiments, the dissolvable fuse 1502, 1602, the sensor may be interrupted. Sensors may be used to moni
1702, 1802, and 1902 in FIGS. 15-19, respectively, is 15 tor other biological functions or processes, as described
replaced with a contaminant sensing element that is activated above, and should not be viewed as being limited to glucose
upon sensing the presence of a contaminant, electrical change sensors. The sensor applications apply to meters as well as
or physical change. Thus, the contaminant-sensing element monitors, and covers applications that take discrete measure
may open a Switch upon sensing the presence of a contami ments, continuous measurements, near-continuous measure
nant, electrical change, or physical change to disable the ments, pulsatile measurements, intermittent.
system. In alternative embodiments, the contaminant-sensing Controlled failure can be important in sensor monitoring
element may open a circuit under normal conditions, and applications, since the sensors are often used to determine the
close the circuit upon sensing the presence of a contaminant, quality or compliance in a process, therapy, or the like. In
electrical change, or physical change to disable the system. medical applications, the user may be dependent on sensor
In all of the above embodiments, when a disabling event 25 readings to determine the amount of medication to adminis
occurs, the controller may be operative to produce Some form ter. Erroneous data could make treatment ineffective or
ofuser-perceptible signal in response to the completed circuit deadly. If the sensor is part of an automated or semi-auto
to alert a user that a contaminant has been sensed within the mated closed loop system that includes a sensor system, a
system. For example, an warning message may be displayed patient could be adversely affected during a sensor system
on a display associated with the electrical system. As another 30 failure without notice, since the aim of a closed loop system
example, an audio tone may be generated on a speaker or is to minimize user interaction with the system. A user could
other output device associated with the electrical system to then get too much or too little medication, drugs, and/or
alert a user that the electrical system has detected a fault and fluids.
is presently shutting down. As yet another example, the elec From the above, one of ordinary skill in the art can readily
trical system may vibrate in a manner that a user may detect. 35 appreciate the applicability of embodiments of the present
In some embodiments, the device may be further operative to invention to other devices and systems that require and/or
safely shut down the electrical system once a contaminant has benefit from the controlled failure that can be achieved to
been sensed. In further embodiments, the controller or other minimize or eliminate the possibility harm to users of the
device may require a reset before the electrical system may devices or systems.
again become operational. In still other embodiments, the 40 While the description above refers to particular embodi
system may send a signal to another device, shut down per ments of the present invention, it will be understood that
manently, operate a predetermined steady state or rate, trigger many modifications may be made without departing from the
an irreversible destruction or disablement of the device, or the spirit thereof. The accompanying claims are intended to cover
like. such modifications as would fall within the true scope and
In the embodiments described above, the selective potting 45 spirit of the present invention.
has been described in relation to the power driver circuit, a The presently disclosed embodiments are therefore to be
controller, and a DC motor or drive system. However, the considered in all respects as illustrative and not restrictive, the
embodiments of the present invention are not limited to the Scope of the invention being indicated by the appended
specific illustrations, and many variations in layout, type of claims, rather than the foregoing description, and all changes
devices and components may be made. For instance, the 50 which come within the meaning and range of equivalency of
selective potting may be directed to causing the power Supply the claims are therefore intended to be embraced therein.
portion to be the portion to fail controllably by leaving it as the What is claimed is:
portion that is left un-encapsulated and it then fails when 1. A system for providing electrical power to an electrical
contaminants are present. In other embodiments, the motor or load, the system comprising:
drive system contains the controller, and the motor is left 55 at least one electrical load terminal for electronic connec
un-encapsulated to controllably fail when exposed to a con tion to a load;
taminant. at least one power Supply terminal for electronic connec
Although primarily illustrated for infusion devices, the tion to a power source to provide an electrical power
embodiments of the present invention described above are signal on the at least one power Supply terminal;
applicable to the many other devices and systems described 60 safety circuitry electrically coupled between the at least
above. In other words, one or more of the circuit portions one power Supply terminal and the at least one load
described above (e.g., but not limited to, the controller por terminal, wherein a portion of the safety circuitry is
tion, the power driver circuit portion, the power source, the encapsulated with a material that inhibits passage of a
DC motor, or the like), may be substituted by a different predefined contaminant and another portion of the safety
component or system to selectively control the failure of that 65 circuitry is at least partially unencapsulated to allow
component or system. For example by way of illustration, but exposure to the contaminant when the contaminant is
not limited to, the selective potting could be applied to sensor present in the system.
US 7,460,350 B2
21 22
2. A system according to claim 1, wherein an electrical 14. A system according to claim 1, further comprising an
power signal on the at least one power Supply terminal is electrical load coupled to the at least one electrical load ter
applied to the at least one electrical load terminal when the at minal, the electrical load comprises a drive motor coupled to
least partially unencapsulated portion of the safety circuitry is a medical infusion pump.
not exposed to the contaminant, and is disconnected from the 15. A system according to claim 1, wherein the material
at least one electrical load terminal upon Sufficient exposure that encapsulates a portion of the safety circuitry to inhibit
of the at least partially unencapsulated portion of the safety passage of a predefined contaminant comprises a potting
circuitry to the contaminant. material.
3. A system according to claim 1, wherein the safety cir 16. A method of coupling a system for providing electrical
cuitry is configured to connect an electrical power signal on 10 power to an electrical load, the method comprising:
the at least one power Supply terminal to the at least one electrically connecting at least one electrical load terminal
electrical load terminal when the at least partially unencap to a load;
sulated portion of the safety circuitry is not exposed to the electrically connecting at least one power Supply terminal
contaminant and to disconnect the electrical power signal to a power source to provide an electrical power signal
from the at least one electrical load terminal upon sufficient 15 on the at least one power Supply terminal;
exposure of the at least partially unencapsulated portion of the electrically connecting safety circuitry between the at least
safety circuitry to the contaminant. one power Supply terminal and the at least one load
4. A system according to claim 1, wherein the at least terminal; and
partially unencapsulated portion of the safety circuitry encapsulating a portion of the safety circuitry with a mate
includes or is connected to at least one circuit element that is rial that inhibits passage of a predefined contaminant,
dissolvable by the contaminant to disconnect the electrical and maintaining another portion of the safety circuitry at
power signal on the at least one power Supply terminal from least partially unencapsulated to allow exposure to the
the at least one electrical load terminal upon Sufficient expo contaminant when the contaminant is present in the sys
Sure to the contaminant. tem.
5. A system according to claim 4, wherein the dissolvable 25 17. A method according to claim 16, further comprising
circuit element comprises a dissolvable fuse. configuring the safety circuitry to allow an electrical power
6. A system according to claim 1, wherein the at least signal on the at least one power Supply terminal to be applied
partially unencapsulated portion of the safety circuitry to the at least one electrical load terminal when the unencap
includes or is connected to at least one circuit element that sulated portion of the safety circuitry is not exposed to the
senses the contaminant and disconnects the electrical power
30 contaminant and to disconnect the electrical power signal on
signal on the at least one power supply terminal from the at the at least one power Supply terminal from the at least one
least one electrical load terminal upon Sufficient exposure to electrical load terminal upon sufficient exposure of the unen
the contaminant. capsulated portion of the safety circuitry to the contaminant.
18. A method according to claim 16, further comprising
7. A system according to claim 6, wherein the at least one 35 applying an electrical power signal on the at least one power
circuit element that senses the contaminant comprises an Supply terminal to the at least one electrical load terminal
humidity sensor. when the at least partially unencapsulated portion of the
8. A system according to claim 1, wherein the safety cir safety circuitry is not exposed to the contaminant, and dis
cuitry comprises: connecting the electrical power signal from the at least one
a controller for providing the at least one control signal; 40 electrical load terminal upon sufficient exposure of the at least
and partially unencapsulated portion of the safety circuitry to the
a safety circuit for receiving the at least one control signal, contaminant.
wherein the safety circuit is electrically coupled to the at 19. A method according to claim 16, further comprising
least one power Supply terminal and to the at least one connecting or including at least one dissolvable circuit ele
load terminal, and wherein the safety circuit is config 45 ment in the at least partially unencapsulated portion of the
ured to connect the electrical power signal to the at least safety circuitry, wherein the at least one dissolvable circuit
one load terminal upon receipt of the at least one control element is dissolvable by the contaminant to disconnect the
signal and to disconnect the electrical power signal from electrical power signal on the at least one power Supply ter
the at least one load terminal upon no receipt of the at minal from the at least one electrical load terminal upon
least one control signal; 50 sufficient exposure of the dissolvable circuit element to the
wherein the controller comprises the at least partially unen contaminant.
capsulated portion of the safety circuitry. 20. A method according to claim 19, wherein the dissolv
9. A system according to claim8, wherein the safety circuit able circuit element comprises a dissolvable fuse.
comprises the encapsulated portion of the safety circuitry. 21. A method according to claim 18, wherein the at least
10. A system according to claim 8, wherein the safety
55 partially unencapsulated portion of the safety circuitry
includes or is connected to at least one circuit element that
circuit is provided in a Voltage converter. senses the contaminant and disconnects the electrical power
11. A system according to claim 10, further comprising at signal on the at least one power Supply terminal from the at
least one Zener diode coupled between the voltage converter least one electrical load terminal upon Sufficient exposure of
and at least one electrical load terminal. 60 the at least one circuit element to the contaminant.
12. A system according to claim 11, further comprising a 22. A method according to claim 21, wherein the at least
Schottky diode coupled in parallel to the at least one Zener one circuit element that senses the contaminant comprises an
diode. humidity sensor.
13. A system according to claim 11, wherein said at least 23. A system connectable to a power Source and an elec
one Zener diode comprises first and second Zener diodes 65 trical load, for providing electrical power to the electrical
coupled in series, the second Zener diode being coupled in load, the system comprising a safety circuitry configured to
reverse biased arrangement relative to the first Zener diode. be electrically coupled between the power source and the
US 7,460,350 B2
23 24
load, wherein a portion of the safety circuitry is encapsulated of the safety circuitry is not exposed to the contaminant and to
with a material that inhibits passage of a predefined contami disconnect electrical power from the electrical load upon
nant and another portion of the safety circuitry is unencapsu Sufficient exposure of the unencapsulated portion of the
lated to allow exposure to the contaminant when the contami safety circuitry to the contaminant.
nant is present in the system, and wherein the safety circuitry
is configured to connect electrical power from the power
Source to the electrical load when the unencapsulated portion

United States Patent (10) Patent No.: US 7.460,350 B2: Talbot Et Al. (45) Date of Patent: Dec. 2, 2008

Uploaded by

Copyright:

Available Formats

United States Patent (10) Patent No.: US 7.460,350 B2: Talbot Et Al. (45) Date of Patent: Dec. 2, 2008

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

United States Patent (10) Patent No.: US 7.460,350 B2: Talbot Et Al. (45) Date of Patent: Dec. 2, 2008

Uploaded by

Copyright:

Available Formats

USOO746035OB2

(12) United States Patent (10) Patent No.: US 7.460,350 B2

(54) SELECTIVE POTTING FOR CONTROLLED (56) References Cited

U.S. PATENT DOCUMENTS FOREIGN PATENT DOCUMENTS

re-sw-as-a-r-ass series-as re-rrow-r-----esproos-sara---------ressssssssssa assssor a -

1806 1808 1800

You might also like